Nucleus Security
Nucleus Security does not scan for vulnerabilities itself. It collects the findings from a company’s scanners and other security tools, ties them to assets and owners, ranks them by risk and sends fixes to the right teams automatically.
CyberReviewed Editorial Team · Updated · nucleussec.com
Company details
- Score
- 6.9/10Ranked 20 of 27 (tied)
- Category
- Vulnerability management
- Founded
- 2018
- Headquarters
- Sarasota, Florida
- Leadership
- Steve Carter, co-founder and CEO
- Funding disclosed
- $43 million Series B in 2024 led by Arthur Ventures and Lead Edge Capital; $20 million Series C in 2026 led by Delta-v Capital
- Pricing
- Two license tiers quoted by number and type of assets; AWS Marketplace lists a $100,000 platform license for 12 months
- Best fit
- Large enterprises and government agencies running several scanners that need one system of record for vulnerabilities
Our take
Nucleus suits large organizations and federal agencies that already run several scanners and need one place to prioritize and route what they find. It is priced for that audience, with a $100,000 annual license on AWS Marketplace. Reviewers praise its risk-based prioritization but want better reporting and attack path analysis.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 5.4 |
| Product scope and fit | 7.9 |
| Company durability | 7.5 |
| Evidence of adoption | 7.2 |
| Ease of adoption | 6.4 |
| Overall score (average of the five) | 6.9 |
Each criterion is defined on our methodology page.
One record for findings from many tools
Nucleus connects to more than 200 security and asset tools, including vulnerability scanners, and merges their findings into one inventory of assets and vulnerabilities.12 It ranks those findings using business context and exploit intelligence, including Mandiant threat intelligence, which it integrates, and automates the workflows that assign fixes to owners and track them to completion.14 Dashboards and reports are built from the same data.1
The platform is FedRAMP authorized for use by U.S. federal agencies, a process Nucleus began in November 2021 with the Centers for Medicare and Medicaid Services as its sponsor, and In-Q-Tel, the strategic investor for the U.S. national security community, joined its Series B.156
Quoted licenses and a $100,000 listing
Nucleus offers two license tiers, and the price of each depends on the number and type of assets in a customer's environment; buyers get a quote.3 Its AWS Marketplace listing shows one published figure, a platform license at $100,000 for 12 months, which covers the connectors, prioritization and automation without separate add-ons.7
A federal contractor turned software company
Steve Carter, Scott Kuffer and Nick Fleming founded Nucleus in 2018; Carter and Kuffer had worked together at Rampant Technologies, Carter's earlier company, which supported vulnerability management programs at federal agencies.25 A one-year research contract from a large federal agency paid for the first proof of concept.5 The company raised $43 million in 2024 and $20 million in February 2026.62
Customers listed by the company include Motorola, Paychex, Mastercard and Marathon.12
How it compares with Vicarius and Intruder
Vicarius scans endpoints and patches them itself, priced per endpoint. Intruder runs its own external and cloud scanning with published monthly prices for smaller teams. Nucleus does neither scanning nor patching; it sits above many scanners and is built for organizations whose problem is too many findings from too many tools.
Limits
Nucleus depends on other tools for discovery, so buyers still pay for their scanners. Prices are quoted and the one public figure is $100,000 a year, which puts it out of reach for small teams.37 PeerSpot reviewers in 2026 criticized its reporting and said it lacks attack path analysis.89
What customers say
Quoted word for word from public reviews on PeerSpot, retrieved October 24, 2026. Each quote links to the review or post it comes from.
Where it helps
The risk-based prioritization has helped my team focus on the most critical vulnerabilities by considering severity, asset context, and the remediation priorities, rather than just looking at the raw vulnerability counts.
It also offers good prioritization based on the EPSS or the CVSS score, as well as different other factors including Mandiant threat intelligence and similar aspects.
Where it falls short
One of the main issues with Nucleus Security is its lack of reporting capability.
Nucleus Security needs a better view into exposure management, as exposure management and attack path management are missing.
Sources
- Nucleus Security, About, accessed October 24, 2026
- citybiz, Nucleus Security closes $20M Series C to push exposure management, February 2026
- Nucleus Security, Get pricing, accessed October 24, 2026
- Nucleus Security, Frontline stories: discussing the impact of CISA KEV, accessed October 24, 2026
- Nucleus Security, Nucleus and FedRAMP: a full-circle journey in federal security, accessed October 24, 2026
- Help Net Security, Nucleus Security raises $43 million to redefine how businesses manage their attack surface, February 13, 2024
- AWS Marketplace, Nucleus Security listing, accessed October 24, 2026
- PeerSpot, Nucleus Security review by a vulnerability and compliance manager, July 15, 2026
- PeerSpot, Nucleus Security review by a cyber security architect, June 9, 2026
